From: Willem de Bruijn <will...@google.com>
Destruction of the po->rollover must be delayed until there are no
more packets in flight that can access it. The field is destroyed in
packet_release, before synchronize_net. Delay using rcu.
Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
Suggested-by: Eric Dumazet <eduma...@google.com>
Signed-off-by: Willem de Bruijn <will...@google.com>
---
net/packet/af_packet.c | 3 ++-
net/packet/internal.h | 1 +
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index fd51641..20e8c40 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1634,7 +1634,8 @@ static void fanout_release(struct sock *sk)
}
mutex_unlock(&fanout_mutex);
- kfree(po->rollover);
+ if (po->rollover)
+ kfree_rcu(po->rollover, rcu);
}
static const struct proto_ops packet_ops;
diff --git a/net/packet/internal.h b/net/packet/internal.h
index c035d26..e20b3e8 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -89,6 +89,7 @@ struct packet_fanout {
struct packet_rollover {
int sock;
+ struct rcu_head rcu;
atomic_long_t num;
atomic_long_t num_huge;
atomic_long_t num_failed;
--
2.2.0.rc0.207.ga3a616c
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
